okd-project / okd-payload-pipeline Goto Github PK

The kustomization to deploy the argo workflows operator and to create the workflows for building okd require some manual hacks after they are applied:

1. The operator-deployment kustomization needs to lookback at the created Route's host field to catch the redirectURI prefix to set in the OAuthClient object
2. The kustomization for the workflows uses the default namespace transformer. Argo workflows do not support a memorization config map reference outside its deployment namespace. Therefore, the service account running the workflow in the workflow's namespace needs CRUD permissions on the configmaps resource in the argo-workflows namespace. However, creating a RoleBinding for it within the same kustomization overlay leads to a RoleBinding being created in the namespace set in the namespace field of the kustomization (we cannot prevent changing it). Insteda, we would like changing the subject's namespace to the one set in the kustomization.yaml's namespace field.

        - name: VERSIONS
          value: "kubernetes=1.25.0"
          # TODO ^^ dynamic handling from the pipeline

https://github.com/okd-project/okd-payload-pipeline/blob/aeeb5410022115a073f0412337051b8514a2605a/buildconfigs/10-hyperkube.yaml

Please add licensing information to this repo

I think we have a circular deps for main images:

• base is build from tools - https://github.com/okd-project/okd-payload-pipeline/blob/main/buildconfigs/05-base.yaml
• tools is built from cli - https://github.com/okd-project/okd-payload-pipeline/blob/main/buildconfigs/20-tools.yaml
• cli is built from base - https://github.com/okd-project/okd-payload-pipeline/blob/main/buildconfigs/06-cli.yaml

Its not clear where to start when we want to build "real" base image with golang and things

/cc @aleskandro

https://argoproj.github.io/argo-workflows/cron-workflows/

The latest release for openshift console is 4.14/4.15 and Dockerfile has been changed since 4.12->4.13. Currently, okd is at 4.12.

When mirroring an initial payload, any previously built image will be replaced. In the case that image is built recently enough and no new commits are pushed in its repo, the workflow might skip the build because of a cache hit in the memoization system.

Possible fixes:

• Add the SHA of the built image in the memoization key
• ??

Tracker for openshift/cluster-baremetal-operator#337

Its very lonely at https://quay.io/repository/okd/builder.

We probably should push base and other intermediate images as well - this will speed up hacking on images for external contributors

We currently use:

• alpine/git from docker.io
• the internal registry cli image
• the internal registry python image

Some containers also install tools (yq, mtl, ...), as a temporary workaround. We could have a single image to address all the workflow jobs.

when creating the payload image:

info: Included 183 images...contained an invalid image-references file: no input image tag named "nutanix-cloud-controller-manager"

The name of the referenced ovn-kubernetes image changed to ovn-kubernetes-rhel-9. The same is for ovn-kubernetes-microshift-rhel-9.

See https://github.com/openshift/machine-config-operator/blob/eebcd95ce3be079098c06c4a0f1bb28b072e99ff/Dockerfile#L33

Just a reminder to address the discussion in #14

Due to the changes in the artifacts image that now put the rpms in the /srv/repo/$arch dir, the okd-machine-os Dockerfile should be updated to address this new behavior. This work could also be part of making the new dockerfiles for hyperkube, cli (and artifacts) upstream.

cc @vrutkovs